Skip to content

chore(deps): update amannn/action-semantic-pull-request action to v6 #1842

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
renovate wants to merge 2 commits into
base: main
Choose a base branch
from
Open

chore(deps): update amannn/action-semantic-pull-request action to v6 #1842

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
428bdaf
chore(deps): update amannn/action-semantic-pull-request action to v6
renovate[bot] Feb 12, 2026
7ef0a9d
Merge branch 'main' into renovate/amannn-action-semantic-pull-request…
zmdavis Feb 19, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/lint-pr-title.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ jobs:
name: Validate PR title
runs-on: ubuntu-latest
steps:
- uses: amannn/action-semantic-pull-request@v5
- uses: amannn/action-semantic-pull-request@v6
Copy link

@semgrep-code-launchdarkly semgrep-code-launchdarkly bot Feb 1, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Semgrep identified an issue in your code:
An action sourced from a third-party repository on GitHub is not pinned to a full length commit SHA. Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload.

To resolve this comment:

✨ Commit Assistant fix suggestion

Suggested change
- uses: amannn/action-semantic-pull-request@v6
- uses: amannn/action-semantic-pull-request@7e7756342d687a84eff23acb7b5bd1c0e7b17750
# Pinned to commit SHA for security: https://github.com/amannn/action-semantic-pull-request/commit/7e7756342d687a84eff23acb7b5bd1c0e7b17750
View step-by-step instructions
  1. Replace the version tag @v6 in uses: amannn/action-semantic-pull-request@v6 with the specific full commit SHA for the version you want to use, such as @7e7756342d687a84eff23acb7b5bd1c0e7b17750.
  2. Find the correct commit SHA by visiting the action's GitHub repository (for example, https://github.com/amannn/action-semantic-pull-request/tags), selecting your desired release or tag, and copying the full 40-character commit hash.
  3. Update the uses line to: uses: amannn/action-semantic-pull-request@<commit-sha> (replace <commit-sha> with the actual SHA you copied).
  4. Save the changes.

Pinning GitHub Actions to a specific commit SHA ensures the action code cannot change unexpectedly in the future, which reduces the risk of using compromised third-party code.

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

  • /fp <comment> for false positive
  • /ar <comment> for acceptable risk
  • /other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by third-party-action-not-pinned-to-commit-sha.

You can view more details about this finding in the Semgrep AppSec Platform.

with:
validateSingleCommit: true
env:
Expand Down
Loading